GitHub CLI Files

Expiring, auto-refreshing OAuth tokens (preview)

gh can now sign in with expiring OAuth credentials that it refreshes automatically. When you opt in, gh stores a short-lived access token alongside a rotating refresh token and refreshes the access token whenever it is needed, so you stay signed in without having to authenticate again.

To opt in for a single sign-in, run:

:::shell
gh auth login --expiring

To prefer expiring credentials for every sign-in, run:

:::shell
gh config set expiring_credentials enabled

gh auth status shows whether a credential is refreshable and when the current access token expires. Both gh auth status and gh auth token automatically refresh the access token when needed. Expiring tokens are available on github.com and GHE.com; on hosts that do not issue them, gh falls back to a regular non-expiring token.

If you use HTTPS as your git protocol, we advise using git 2.46 or newer and letting gh act as your git credential helper by running gh auth setup-git. This way gh serves and refreshes the expiring credential for git, and git does not cache it past its lifetime.

[!IMPORTANT] Expiring access tokens should not be cached. Scripts and extensions that store the output of gh auth token will eventually hold an expired token, so run gh auth token again each time a token is needed. Tokens supplied through GH_TOKEN or GITHUB_TOKEN are never refreshed.

For more information, see Authenticating with GitHub CLI.

Manage issue artifacts with gh issue artifact (private preview)

gh issue artifact brings issue artifacts to the command line. Users and organizations enrolled in the private preview can use the list, view, create, edit, download, and delete commands to manage issue artifacts.

:::shell
# Create a Markdown document with an attached image
gh issue artifact create 142 signin-plan.md --attach ./signin-flow.png

# Create an HTML document
gh issue artifact create 142 menu-prototype.html

# List or view artifacts
gh issue artifact list 142
gh issue artifact view 142 2

# Update a document or restore an earlier version
gh issue artifact edit 142 2 --body-file signin-plan-v2.md
gh issue artifact edit 142 2 --restore-version 5

Artifacts can also be addressed by their GitHub URLs, and Markdown documents support image and video attachments with --attach.

[!IMPORTANT] Issue artifacts are in private preview. These commands only work for repositories enrolled in the preview. See the Issue Artifacts private preview announcement and feedback discussion for access instructions and to share feedback.

What's Changed

✨ Features

• Replace extension browse with Bubble Tea by @williammartin in https://github.com/cli/cli/pull/14578
• gh issue artifact stack 1/12: Resolve --attach references against the body file's directory by @BagToad in https://github.com/cli/cli/pull/14564
• gh issue artifact stack 2/12: Attach one set of files to several Markdown documents by @BagToad in https://github.com/cli/cli/pull/14565
• gh issue artifact stack 3/12: Add the command group and list by @BagToad in https://github.com/cli/cli/pull/14566
• gh issue artifact stack 4/12: Add view by @BagToad in https://github.com/cli/cli/pull/14567
• gh issue artifact stack 5/12: Add delete by @BagToad in https://github.com/cli/cli/pull/14568
• gh issue artifact stack 6/12: Add download by @BagToad in https://github.com/cli/cli/pull/14569
• gh issue artifact stack 7/12: Add create by @BagToad in https://github.com/cli/cli/pull/14570
• gh issue artifact stack 8/12: Add edit by @BagToad in https://github.com/cli/cli/pull/14571
• gh issue artifact stack 10/12: Add edit --restore-version by @BagToad in https://github.com/cli/cli/pull/14580
• gh issue artifact stack 11/12: Address review feedback by @BagToad in https://github.com/cli/cli/pull/14640
• gh issue artifact stack 12/12: Add artifact URLs by @BagToad in https://github.com/cli/cli/pull/14678
• Support HTML documents in gh issue artifact by @BagToad in https://github.com/cli/cli/pull/14720
• Refreshable tokens (1/7): foundation credential model, storage migration, and file lock by @babakks in https://github.com/cli/cli/pull/14450
• Refreshable tokens (2/7): refresher domain, OAuth refresher, storage, and wiring by @babakks in https://github.com/cli/cli/pull/14451
• Refreshable tokens (3/7): short-lived login, refresh, and git credential path by @babakks in https://github.com/cli/cli/pull/14452
• Refreshable tokens (4/7): gh auth token refresh and secure-storage handling by @babakks in https://github.com/cli/cli/pull/14453
• Refreshable tokens (5/7): gh auth status short-lived token details by @babakks in https://github.com/cli/cli/pull/14454
• Refreshable tokens (6/7): agent-task and CAPI per-request refresh by @babakks in https://github.com/cli/cli/pull/14455
• Refreshable tokens: review fixes across the stack by @babakks in https://github.com/cli/cli/pull/14663
• Refreshable tokens: rename --short-lived flag to --expiring by @babakks in https://github.com/cli/cli/pull/14665
• Refreshable tokens: add prefer_expiring_credentials config option by @babakks in https://github.com/cli/cli/pull/14672
• Refreshable tokens: capture auth_invocation telemetry on login and refresh by @babakks in https://github.com/cli/cli/pull/14673
• Refreshable tokens: review fixes (round 2) by @babakks in https://github.com/cli/cli/pull/14717
• Refreshable tokens: show relative time-to-expiry in gh auth status by @babakks in https://github.com/cli/cli/pull/14745
• Refreshable tokens: build-gated debug overrides for testing token expiry by @babakks in https://github.com/cli/cli/pull/14752
• Refreshable tokens: bump cli/oauth to v1.3.0 and fix gh status column width by @babakks in https://github.com/cli/cli/pull/14768

🐛 Fixes

• Bump go-runewidth to v0.0.30 for faster startup by @williammartin in https://github.com/cli/cli/pull/14577
• Avoid spawning git for each extension at startup by @williammartin in https://github.com/cli/cli/pull/14620
• Fix the unclean background colors of gh-search-code by @A4-Tacks in https://github.com/cli/cli/pull/14648
• Fix help text that references nonexistent flags by @BagToad in https://github.com/cli/cli/pull/14719

📚 Docs & Chores

• docs: recommend nix-shell and declarative config for Nix/NixOS by @reginaldalfret in https://github.com/cli/cli/pull/14592
• Clarify issue view comment output modes by @babakks with @Copilot in https://github.com/cli/cli/pull/14616
• Add ACCESSIBILITY.md by @BagToad in https://github.com/cli/cli/pull/14583
• Bump shell-quote to 1.11.0 in cli-exercise skill by @williammartin in https://github.com/cli/cli/pull/14625
• Leave validation checks to CI in bump-go script by @williammartin in https://github.com/cli/cli/pull/14631
• Remove CLAUDE.md in favor of AGENTS.md by @jarrensj in https://github.com/cli/cli/pull/14474
• Clarify --repo and --owner checks for attestation bundles by @bdehamer in https://github.com/cli/cli/pull/14650
• Fix Go vendoring in Dependabot triage and bump gh-aw by @williammartin in https://github.com/cli/cli/pull/14682
• gh issue artifact stack 9/12: Document gh issue artifact in the gh skill by @BagToad in https://github.com/cli/cli/pull/14572
• Clarify --comments behavior when piped in view commands by @arsalanyavari in https://github.com/cli/cli/pull/14714
• Clarify release creation atomicity and immutability by @bdehamer in https://github.com/cli/cli/pull/14722
• Add deterministic Dependabot scheduler by @williammartin in https://github.com/cli/cli/pull/14750
• Merge v2.102.1 release branch into trunk by @BagToad in https://github.com/cli/cli/pull/14770
• Refreshable tokens (7/7): guided end-to-end verification scripts by @babakks in https://github.com/cli/cli/pull/14456
• Document expiring tokens in the gh skill by @babakks in https://github.com/cli/cli/pull/14782

:dependabot: Dependencies

• Bump Go to 1.27.2 by @github-actions[bot] in https://github.com/cli/cli/pull/14632
• chore(deps): bump golang.org/x/sync from 0.23.0 to 0.24.0 by @dependabot[bot] in https://github.com/cli/cli/pull/14633
• chore(deps): bump github.com/mattn/go-colorable from 0.1.15 to 0.1.16 by @dependabot[bot] in https://github.com/cli/cli/pull/14634
• chore(deps): bump golang.org/x/crypto from 0.57.0 to 0.58.0 by @dependabot[bot] in https://github.com/cli/cli/pull/14660
• chore(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in https://github.com/cli/cli/pull/14656
• chore(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 by @dependabot[bot] in https://github.com/cli/cli/pull/14655
• chore(deps): bump the codeql-actions group with 3 updates by @dependabot[bot] in https://github.com/cli/cli/pull/14654
• chore(deps): bump charm.land/bubbletea/v2 from 2.0.10 to 2.1.0 by @dependabot[bot] in https://github.com/cli/cli/pull/14657
• chore(deps): bump google.golang.org/grpc from 1.83.2 to 1.84.0 by @dependabot[bot] in https://github.com/cli/cli/pull/14485
• chore(deps): bump github.com/cli/go-gh/v2 from 2.16.1 to 2.16.2 by @dependabot[bot] in https://github.com/cli/cli/pull/14696
• chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0 by @dependabot[bot] in https://github.com/cli/cli/pull/14697
• chore(deps): bump goreleaser/goreleaser-action from 7.2.3 to 7.3.0 by @dependabot[bot] in https://github.com/cli/cli/pull/14707
• chore(deps): bump github.com/klauspost/compress from 1.20.1 to 1.20.3 by @dependabot[bot] in https://github.com/cli/cli/pull/14705
• chore(deps): bump actions/create-github-app-token from 3.2.0 to 3.3.0 by @dependabot[bot] in https://github.com/cli/cli/pull/14706
• chore(deps): bump the codeql-actions group with 3 updates by @dependabot[bot] in https://github.com/cli/cli/pull/14751
• Bump Go to 1.27.3 by @github-actions[bot] in https://github.com/cli/cli/pull/14767
• chore(deps): bump github.com/gabriel-vasile/mimetype from 1.4.15 to 1.4.16 by @dependabot[bot] in https://github.com/cli/cli/pull/14766
• Update glamour to v2 by @heaths in https://github.com/cli/cli/pull/14148

New Contributors

• @reginaldalfret made their first contribution in https://github.com/cli/cli/pull/14592
• @jarrensj made their first contribution in https://github.com/cli/cli/pull/14474
• @A4-Tacks made their first contribution in https://github.com/cli/cli/pull/14648
• @arsalanyavari made their first contribution in https://github.com/cli/cli/pull/14714

Full Changelog: https://github.com/cli/cli/compare/v2.102.1...v2.103.0